×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
HX
Engager
Member since: ‎10-11-2022
‎02-17-2025
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-11-2022
View All

Why is Historical license usage page showing blank...

by in Splunk Enterprise
‎03-21-2023 04:16 PM
‎03-21-2023 04:16 PM
Historical license usage is not showing some days' graph, but the data are all there.  The search string is this, never changed, it worked well before. (index=_internal host=xxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d) | eval _time=('_time' - 43200) | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [| search (index=_internal host=xxxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d) | eval _time=('_time' - 43200) | bin _time span=1d | dedup _time stack | stats sum(stacksz) AS "stack size" by _time] | fields - _timediff | foreach "*" [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3) ] ... View more
Labels

Where can I find Splunk Enterprise 8.2.10?

by in Installation
‎02-26-2023 05:50 PM
‎02-26-2023 05:50 PM
I'm going to upgrade Splunk Enterprise to version 8.2.10, as per the instruction https://advisory.splunk.com/advisories/SVD-2023-0209. However, I can not find the downloading of version 8.2.10, seems been removed from previous releases. Any idea about this? Thanks! ... View more
Labels

How to fix a full Splunk indexer queue?

by in Splunk Enterprise
‎02-08-2023 02:59 PM
‎02-08-2023 02:59 PM
Hi,  one of indexers stops receiving events as the indexer queue is full. I check the splunkd.log, see lots of error message,  02-09-2023 09:49:02.354 +1100 ERROR pipeline [1807 indexerPipe_1] - Runtime exception in pipeline=indexerPipe processor=indexer error='Unable to create directory /mnt/splunk_index_hot/_internaldb/db/hot_v1_311115391 because Input/output error' confkey='source::/opt/splunk/var/log/splunk/splunkd.log|host::hostname|splunkd|1456359' 02-09-2023 09:49:02.354 +1100 ERROR pipeline [1807 indexerPipe_1] - Uncaught exception in pipeline execution (indexer) - getting next event Anyone came cross this situation? How to fix it up? Thanks! ... View more
Labels

List the count of hosts by index for each day- My ...

by in Splunk Search
‎10-11-2022 08:32 PM
‎10-11-2022 08:32 PM
I would like to get the number of hosts per index in the last 7 days, the query as below gave me the format but not the correct number.   | tstats dc(host) where index=* by _time index | timechart span=1d dc(host) by index Any idea? Thanks!                           Index A Index B Index C Index D Index E Index F Index G Index H Index I Index J 2022-10-05 0               0                0             0               0             0              0              0           0            0  2022-10-06 0               0                0             0               0             0              0              0           0            0 2022-10-07 0               0                0             0               0             0              0              0           0            0 2022-10-08 0               0                0             0               0             0              0              0           0            0 2022-10-09 0               0                0             0               0             0              0              0           0            0 2022-10-10 0               0                0             0               0             0              0              0           0            0 ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎02-17-2025 02:15 AM